[0B2E7F]

显示全部楼层 · 发表于 2007-7-21 21:12:07

Qucikheal查杀病毒只要弄一个 suspicious就OK了。。。不需要特征码

显示全部楼层 · 发表于 2007-7-21 21:14:50

原帖由 aerbeisi 于 2007-7-21 21:08 发表
detected: riskware Invader Running process: S168.exe

可惜作者不能做到365天更新，每小时更新一次。不能过主防。

每小时

显示全部楼层 · 发表于 2007-7-21 21:19:19

C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_sys.mem  2007-07-21 21:14:58
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_sys.mem  2007-07-21 21:15:00
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_sys.mem  2007-07-21 21:15:01
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_usr.mem  2007-07-21 21:15:02
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_env.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_annex.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_sys.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_usr.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_env.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\Program Files\SogouInput\sgim_annex.mem  2007-07-21 21:15:04
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\WINDOWS\SbiePst.dat  2007-07-21 21:15:23
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\RegHive  2007-07-21 21:15:55
C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\RegHive.LOG  2007-07-21 21:15:55

显示全部楼层 · 发表于 2007-7-21 21:19:25

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.812\S168.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.DLL
3) C:\PROGRAM FILES\COMMON FILES\RELIVE.DLL
是否删除木马程序及其衍生物?

[病毒样本] [0B2E7F]

回复 #9 hj5abc 的帖子